Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i try to use the following command to suppress certain lines of output that contain the strings "DST=192.168.1" or "DST=192.168.2"

tail /var/log/messages | egrep -v -e 'DST=(192\.168\.1\.1)|DST=(192\.168\.2\.1)'

My Regex doesn't work, can someone provide me a working one?

share|improve this question
up vote 3 down vote accepted

grep -v 'DST=192\.168\.[12]\.1'
ought to do the trick.

Don't even need egrep.


If you want to match IPs that differ in a more substantial way:

grep -v 'DST=\(a\.b\.c\.d\|x\.y\.z\.q\)'

You can add more IPs by adding another \| followed by the next IP.

In this case, you might actually want to use egrep (or grep -E, same thing) so it'll look a little nicer, like so:

grep -E -v 'DST=(a\.b\.c\.d|x\.y\.z\.q)'
share|improve this answer
Thanks that works, can you give me also an expression for two different ipadresses like and 239.x.x.x? – user56548 Oct 8 '10 at 15:00
Works, as a charme, i just wonder why this doesn't work proper with colortail? there some ips slips through – user56548 Oct 8 '10 at 15:46
I haven't used colortail so I can't be certain, but perhaps it requires extra escaping of \s or the like? Do you know what regular expression engine colortail uses? (standard, extended, or pcre?) – mark Oct 8 '10 at 16:56
uh sorry, i don't know. but i switched to multitail as you suggested in the other thread and it works really fine. – user56548 Oct 8 '10 at 19:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.